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Abstract 

We describe a pricing structure for the provision of IT services that en¬ 
sures trust without requiring repeated interactions between service providers 
and users. It does so by offering a pricing structure that elicits truthful 
reporting of QoS by providers while making them profitable. This mech¬ 
anism also induces truth-telling on the part of users reserving the service. 
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1 Introduction 


A most important enabler of interactions over the Internet is the notion of trust, 
for it allows access to services, information, and customers without having to 
resort to validating procedures that can increase the complexity of an exchange 
so as to make it impractical. That is why reputations play an important role 
in deciding the level of trust in commercial exchanges, setting the value of 
particular brands, and in deciding whom to consult for professional advice. 

A problem with reputations is that the time scales for their buildup or decay 
can be very long compared to the typical times involved in exchanges between 
a provider and a user non This is not a problem if enough transactions have 
taken place so that a reputation or brand name can be established and made 
known to all parties concerned. In its place a number of trust management mech¬ 
anisms for online environments have been proposed, ranging from the familiar 
reputation methods used by eBay, to the creation of trust records and model 
based compliance tools for the assurance of utility computing customers PH. 

In all these cases, either history or repeated interactions with a customer 
or system are necessary in order to establish a level of trust. But in many 
cases, especially those involving one time exchanges or new providers of services, 
the repeated interactions necessary to establish a reputation are not feasible. 
Indeed, there are many situations in online environments where no reputation 
is available while needing assurance that a particular quality of service (QoS) 
will be provided within a single exchange. An example could be access to a 
utility data center that promises a given QoS level, but the user cannot ascertain 
whether or not that level of service will be provided. 

In this paper, we consider the most basic model for quality of service. In 
our model, a quality of service contract describes the likelihood that the service 
provider delivers the promised service. We have designed a mechanism that 
forces the provider to reveal his true assessment of the probability that he will be 
delivering a given service in a single interaction with a user/customer. We also 
solved the complementary truth telling reservation problem of obtaining from 
the user his assessment of the true probability that a given level of resources 
will be required at the time of their delivery. In both cases, our mechanisms use 
a contingent contract to elicit true revelation of both QoS and likelihood of use 
through a pricing structure that forces the parties to make accurate assessments 
of their ability to do what they commit to. 

We also show that the combination of the two mechanisms, i.e. QoS and 
truth-telling reservations, provides an approach to solve the overbooking prob¬ 
lem in reservation. The overbooking problem is when offering a service, the 
provider promises delivering more than he is actually able to do. The provider’s 
incentive is based on the belief that some users may not actually use the service 
due to uncertainty about their own needs. However, overbooking can cause the 
provider to lose significantly if the user’s needs exceeds the provider’s capacity. 
In our case, by using truth telling reservations, the service provider can obtain 
better estimates of the number of users who actually need the service. We can 
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then couple those estimates with a quality of service contract to deal with the 
overbooking problem. 

Related work. There has been extensive work on the study of reputation as 
a basis for trust PH E El El Some recent work PEI also describes mechanisms 
that let the users report their past experience truthfully so as to allow a more 
accurate buildup of reputations. As mentioned above, it requires a long time to 
establish reputations, and we are primarily interested in interactions for which 
there is not sufficient past history. There are also related papers in 0P on 
trading mechanisms for trust revelation. They show that one can enforce truth¬ 
ful trust revelation through the amount of goods to be traded. In that work the 
setting is different from the problem we consider for there is no flexibility on 
the amount of goods the buyer purchases. Instead, we use contingent contracts 
to let the service provider reveal the quality of service. 

2 The Quality of Service (QoS) Problem 

2.1 The problem 

Consider the following one-time exchange problem between two parties: a user 
and a service provider. The user is interested in buying a service from the 
provider. Because of physical constraints, the service provider cannot always 
provide the service to a satisfactory level, but can only do so with a probability 
q £ [0,1], which we call the quality of service ( QoS). Suppose the service provider 
knows the real q but the user does not. We wish to design a mechanism that 
induces the service provider to report the true QoS to the user. 

2.2 The mechanism 

We describe a contingency mechanism: 

1. The service provider tells the user his QoS q' , which may or may not be 
the real QoS q. 

2. The user pays the service provider a premium g{q')- 

3. If the service provider fails to provide the service (to a satisfactory level), 
he pays the user a compensation h{q'). 

Here g , h. : [0, 1] —■» K + are two functions whose forms are to be determined. 

For a risk-neutral user, he has the following form of expected utility: 

EUi = qv-g(q') + (l-q)h(q'), (1) 

where v > 0 is his value of using the service, and g(q') — (1 — q)h(q') is his 
expected cost. Similarly, we assume that the service provider is risk-neutral, 
and his expected utility is given by 

E£/ 2 = <?(<?') - (1 - q)h(q') - C, (2) 
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where c > 0 is his cost. Here we have assumed that c is a fixed cost ex ante. That 
is, the service provider has to spend this cost whether or not he can successfully 
provide the service later. We further assume c < v for there to be business. 

Suppose furthermore that both parties are rational , so they maximize their 
expected utilities respectively. In particular, the service provider will report the 
q' that maximizes Eq. Since we wish to induce him to report the true QoS, 
Eq. m should be maximized at q' = q. This naturally leads to the following 
definition: 

Definition 1. (g,h) is called truth-telling on an interval I C [0,1] if for any 
q £ I and any q' £ [0,1] with q' ^ q 

w(q) = g(q) - (1 - q)h(q) > g(q ) - (1 - q)h(q) . (3) 

From this definition, the service provider will report the true QoS if it is 
in the truth-telling interval of (g, h). If that happens, his expected income is 
w(q). Clearly, he prefers using the mechanism to not selling any service when 
w(q) > c. On the other hand, knowing that the service provider will report the 
real g, the user prefers using the mechanism to staying idle when w(q) < v. We 
thus make the second definition: 

Definition 2. (g, h) is called incentive compatible on an interval I C [0,1] if 
c < w(q) < qv for all v £ I. 

To summarize, if (g, h) is truth-telling and incentive compatible on some 
interval I C [0,1], then whenever q £ /, the user and the service provider both 
want to use the mechanism, and the service provider reports his real QoS. In 
the following, we will give examples of such pairs of (g, h). 


2.3 Realizations 

In this section we give concrete realizations of the functional form (g, h ) that 
are both truth-telling and incentive compatible. Such pairs are not unique. We 
give two families of designs with different forms of compensation. The most 
intuitive choice is to require the compensation proportaional to the quality of 
service. Such linear compensation scheme is appropriate for non mission critical 
services. 


Proposition 1 (Linear compensation). Suppose k,c\ are positive numbers 
satisfying c < c± < v — k. Let 


Then the choice 


Qo 


v — V v 2 — 4fcci 
2k 


(4) 


g(q) — -kq 2 + 2kq + ci, h(q) = 2kq (5) 

is truth-telling and incentive compatible on [go, !]• 
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Proof. Clearly g{q),h{q) > 0 for all q € [0,1]. ( g , h) is truth-telling because 

g{q') - (! - q)Kq') = -k{q' - g) 2 + kq 2 + ci (6) 

is maximized at q' = q with the value w(q) — kq 2 + c±. The incentive compat¬ 
ibility part is just some basic algebra. Figure ^a) plots the function g,h for a 
particular set of parameters. 

The parameter k determines the curvature of the function g: the larger k, 
the more curved is g. □ 

The linear compensation scheme is not appropriate for the services which 
require high reliability. In the areas such as in telecommunications and in fi¬ 
nancial IT services, the quality of service is often represented by the “number of 
nines” that measures how close it is to 1. For example “five nines” is equivalent 
to q = 0.99999. For these services it is more appropriate to set the compensation 
proportional to — log(l — q). This leads to the following design. 

Proposition 2 (Logarithmic compensation). Suppose k,c i are positive 
numbers satisfying c < c\ < v — k. Let g 0 = ( c i + k)/v. Then the choice 

g(q)=kq + c 1 , h(q) = —fclog(l — q) (7) 

is truth-telling and incentive compatible on [go, 1). 

Proof. Under our assumptions g(q),h(q) > 0 for g £ [0,1). Consider the func¬ 
tion 


G(q') = g(q') - (1 - q)h(q') = kq + a + k( 1 - g) log(l - q). (8) 

First order condition 

G'(g') = k ^ = 0 (9) 

i - g 

is satisfied when q' = q. Since 

G'V } = -fc(i^ <0 , (10) 

G{q') is maximized at q' = q with the maximum value 

w (q) = k(l — q) log(l — q) + kq + Ci- (11) 

Thus (g, h) is truth-telling on [0,1). 

Because 

w'{q) = ~k\og(l - q) > 0, (12) 

w(q) is nondecreasing on [0,1). By our assumptions 

u>(0) = ci > c, (13) 

w(l—) = ci+A; = gou. (14) 

Thus (g, h) is incentive compatible on [go, 1). □ 
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(a) 



q 

(b) 


Figure 1: Plot of the premium and compensation functions for (a) linear com¬ 
pensation scheme; and (b) logarithmic compensation scheme. The parameters 
for both figures are c = 1, v = 5, k = 2, ci = 1. The incentive compatible 
interval is [0.219,1] for (a) and [0.6,1] for (b). The curve g{q ) is the premium 
and h(q) is the compensation. 
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Remark. In both examples, the pairs (g, h) is truth telling in the full interval 
[0,1], It is the incentive compatibility requirement that restricts the applicable 
interval. Therefore, once the service provider decides to participate, we expect 
him to be truth-telling. In both examples, qo —■> 0 as v —> oo. In words, the 
more valuable the service, the larger is the incentive compatible interval. 


3 The reservation problem 

3.1 The problem 

In the last section we described QoS as the probability that the service provider 
can successfully provide the service. The probability q thus captures the random 
nature of supply. We now introduce a second probability p to describe the 
randomness of demand. For simplicity, assume that there are two periods: 1 
and 2. With probability p the user will need one unit of service in period 2, and 
he knows this probability of needing it in period 1. The service provider wishes 
to know the real p in period 1 so that he can set up the correct quota of service 
beforehand at a relatively low cost. In what follows we describe a contingent 
contract that incentivizes the user to report his probability of usage truthfully. 

3.2 The mechanism 

In what follows we will use p and q to denote real probabilities, and use p' and 
q' to denote proposed probabilities. 

1. (Period 1) The service provider tells the user his QoS q' , which may or 
may not be his real QoS q. 

2. (Period 1) The user tells the service provider a probability p' that he will 
need the service in period 2, which may or may not be equal to p. 

3. (Period 1) The user pays the service provider a premium g{p ', q'). 

4. (Period 1) The service provider prepares p' unit of service for the user. 

5. (Period 2) If the service provider cannot provide the service (which hap¬ 
pens with probability 1 — q), he pays the user a compensation h{p',q'). 
Otherwise, the user can get the service at the price f(p') if he needs it. 

Using the mechanism, the user’s expected cost is 

EC{p\q') = g(p',q') +pqf(p') - (1 - q)h(p',q'). (15) 

In period 2, the user gets value v if he needs the service and can obtain it. Hence 
his value in period 1 can be described by a random variable 

y | v with probability pq, , lg . 

1 0 with probability 1 — pq. 
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So his expected utility in period 1 is 

EUi = E[V - C] = pqv - EC. (17) 

The service provider collects EC from each user in expectation and his cost 
is cp. Thus his expected utility is 


E U 2 = EC - cp. (18) 

If both parties are rational and risk-neutral, then the service provider max¬ 
imizes EC(p',q') for q' while the user minimizes EC(p 7 ,q') for p'. So they are 
playing a constant sum game. 

Similar to the pure QoS problem, we make two definitions: 

Definition 3. (g, /, h) is called truth-telling on a region I C [0, l ] 2 if for any 
(P, q) e I and any (p', q') G [0, l ] 2 with (p', q') (p, q) 

w(p,q) = g(p,q)+pqf(p,q)-(i-q)h(p,q) (19) 

> 9(p’, q') + pqf{p', q') - (i - q)h(p ', q') . (20) 

Definition 4. (g, f, h) is called incentive compatible on a region I C [0, l ] 2 if 
cp < w(p , q) < pqv for all (p, q) G I. 

According to the above definition, if ( g , /, h ) is truth-telling and incentive 
compatible on some region I C [0,1 ] 2 , then whenever (p, q) G I, the user and 
the service provider both want to use the mechanism. The user reports his true 
probability of usage, and the service provider reports his real QoS. We will show 
such triplet (g. /, h) does exist. 

3.3 Realization 

Following the linear compensation scheme, we can design the following functions 
which are truth-telling and incentive compatible. 

Proposition 3. Consider the following choice of (g,f,h): 

g{p\ q') = kip ' 2 - k 2 q ' 2 + 2 k 2 q' + ci, ( 21 ) 

f(p') = - 2 k lP ' + c 2 , (22) 

h(p', q') = k\p ' 2 + 2k 2 q' + C 3 , (23) 

where k\,k 2 ,c\,c 2 ,c^ are positive numbers satisfying c 2 > 2 k\, C\ — C 3 > c and 
c < ci+c 2 — ki + k 2 < v. Then there exist po < f and < 1 such that (<?, /, h) is 
truth-telling and incentive compatible on [po, 1] x [qo, 1]- Furthermore po, <70 —> 0 
as v —> 00 . 


Proof. It can be calculated that for our choice of (g, /, h) 

E C(p',q') = kxq(p'-p) 2 -k 2 (q'-q) 2 -kip 2 q+k 2 q 2 + c 3 q + c 2 pq + ci-c 3 , (24) 



so {p',q') = (p, q) is a saddle point of EC(p', q'). Thus (g,f,h) is truth-telling 
on [ 0 , l] 2 . 

From Eq. (PI) we see that 

w{p, q) = -kip 2 q + k 2 q 2 + c 3 q + c 2 pq + Ci - c 3 . (25) 

By assumption cp < w(p , q) < vpq at p = q = 1. By continuity, there exists a 
region [po, 1 ] x [go, 1 ] on which cp < w{p , q) < vpq. 

Next we show that for any p 3 ,qo >0 there exists v large enough such that 
( g , /, h) is incentive compatible on I = [po, 1] x [go, 1 ], Since I is compact, the 
continuous function w(p,q) achieves its maximum value % on I. Pick v so 
large that vpoq 3 > wm, and we have w(jp, q) < wm < vpoqo < vpq for (p, q) £ I. 
For the other direction, note that 

duj 

- 7 ^ = C 2 p - fcip 2 + 2 k 2 q + c 3 > 0, (26) 

so w is increasing in q. Therefore for (p, q) £ I we have 


w(p, q) > —kip 2 qo + k 2 ql + c 3 q 0 + c 2 pq 0 + Ci - c 3 > Ci - c 3 > cp. (27) 
Hence ( g , /, h ) is incentive compatible on I. □ 

Remark. We note that in the above proof, it is relatively easier to argue the 
truth-telling property. However, it is harder to prove the incentive compati¬ 
bility and to calculate the analytical form of the interval in which the scheme 
is incentive compatible. It is possible to design schemes by using the logarith¬ 
mic compensation function. It is considerably more challenging for proving the 
incentive compatibility. 


4 Application to finite resource reservation 

Besides the obvious advantages that our mechanism brings to the problem of 
determining QoS in single exchanges and truth-telling in reservations, there are 
other scenarios which can also profit from it. These scenarios are characterized 
by the fact that resources are finite and thus they can lead to severe overbooking 
problems. For example, consider the case where there are m available units of 
resource (plane seats, conference rooms, etc.) and n users. Each user may need 
to consume one unit in period 2. If n < m then our reservation mechanism 
for infinite resource works without problems. If n > to, however, the service 
provider can no longer guarantee the delivery of one unit in period 2 , even if 
the user reserved in period 1 . 

This is known as the overbooking problem in a reservation system. One 
existing method, used for example in the airline industry, for dealing with the 
overbooking problem is by holding an auction at period 2 until enough users 
surrender their reservations for monetary compensation. This process is often 
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expensive to the service provider, and can be gamed by some users willing to 
benefit from such compensation. Our mechanism can solve this in the following 
fashion. 

Suppose n users arrive and make reservations one after another. In period 
2 when they claim their needs, they are satisfied one by one in the order of 
their arrivals, until there are no more available resources left. The first m users 
for sure can be satisfied, so in period 1 the coordinator simply sells them to 
plain truth-telling options with q = 1 as in the infinite resource problem, and 
the users truthfully report their probabilities of needing one unit of resource in 
period 2 , which we call pi, ■ ■ ■ , p rn ■ 

Now consider the (m + l)’th user. The first m probabilities p i,... ,p m known 
by the service provider can help him to estimate the QoS q m + 1 for the (?n + l)’th 
user. For example, under the assumption that the users’ usage probabilities are 
independent, with probability pi---p m the first to users will each need one 
unit of resource in period 2. If that happens, user m + 1 cannot be satisfied. 
Therefore, the probability q m +i = 1 — pi ■ ■ ■p m can be regarded as the QoS for 
the (m + l)’th user. Thus, the coordinator sells the (m + l)’th user an option 
with QoS q m + i, as specified in Section 0 and the (m + l)’th user reports his 
true probability of using one unit of resource in period 2 , denoted by p m + 1 - 
Once the coordinator knows p m + 1 , he can calculate the quality of service for 
the (to + 2)’th user, and can sell the (to + 2)’th user an option with QoS q m+2 
and so on. If everyone is risk-neutral and rational, then all the probabilities p 
and q will be truthful. 

The effectiveness of the procedure just described depends on the accuracy 
of the estimation of qi from pi,... , Pt-i, a problem similar to time-series pre¬ 
dictions. If the estimation process is not designed appropriately, the error may 
accumulate and propagate to the very last step, i.e. the service provider will 
systematically err in estimating QoS for all subsequent users. In addition to us¬ 
age probabilities, the service provider may also take into account the historical 
data. 

Nevertheless in all other cases, including those where the constraint of finite 
resources is not severe, we believe that our contingent contracts can provide 
an efficient procedure for delivering services without resorting to either long 
histories of auction systems that can be gamed. 

5 Conclusion 

In this paper we presented a mechanism that forces a service provider to reveal 
his true assessment of the probability that he will be delivering a given service 
in a single interaction with a user/customer. We also solved the complementary 
truth telling reservation problem of obtaining from the user his assessment of 
the true probability that a given level of resources will be required at the time 
of their delivery. In both cases the mechanism elicits true revelation of both 
QoS and likelihood of use through a pricing structure that forces the parties to 
make accurate assessments of their ability to do what they commit to. 
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Throughout, we considered the most basic model for quality of service, one 
in which the service contract describes the likelihood that the service provider 
delivers the promised service. We also showed that the combination of the 
two mechanisms, i.e. QoS and truth-telling reservations, provides an elegant 
approach to the overbooking problem in reservation. 

There are ongoing experiments with human subjects to verify the effective¬ 
ness of these mechanisms. The initial results are encouraging, and the detailed 
experimental results will soon be reported. We also plan to apply the scheme 
to practical IT service reservations and to design concrete schemes that are 
appropriate for different scenarios. 
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